A lead developer leaves. The repository still opens. Somewhere in the contract folder there is a signed NDA – and nobody in the company can say which files it covered, who approved that person’s access, or what audit trail exists. That is how most leak cases actually start, and it is rarely a situation a signed document can rescue.
Most companies compare having an NDA with not having an NDA. Under Belarusian law that comparison decides nothing. The comparison that decides a case is between a contract on file and a trade secret regime in operation.
By the end of this article you should be able to judge, for your own company, whether you could evidence four things at the moment of a leak: that the specific information was inside a protected scope, that the person had authorised access, what safeguards were actually running, and what left and when.
Many companies assume that a confidentiality document is the same thing as a protection regime. In reality, it is only one of the measures that make up that regime. Protection under Belarusian law starts when the owner sets out the scope of the protected information and implements the necessary measures. The signature simply records a commitment. It does not, by itself, make the information legally protected.
This issue goes well beyond procedure. Without a regime in place, a leak can no longer be pursued as a trade secret case. It is treated instead as an ordinary contract or damages dispute, and the company starts that dispute with far less evidence on its side. It must prove what an obligation actually covered, even though its scope was never set out. It must also demonstrate a loss arising from conduct that cannot be presented as the misappropriation of a protected asset.
The gap between what companies hold and what a dispute needs looks like this:
| What most companies have on file | What a leak dispute actually requires |
| A signed NDA inside a framework contract | A written definition of the protected scope that matches the information that left |
| A confidentiality clause in the employment contract | A documented access regime: who approved access, on what basis, and who revoked it |
| A general statement that “all our code is confidential” | Evidence that the specific repository, module or dataset was inside the defined scope and marked as such |
| A policy PDF circulated once at onboarding | Proof that protective measures were operating at the time of the leak, not merely adopted earlier |
What that table shows is where the burden falls. What it does not show is that documentation guarantees a result: a well-built regime still has to prove causation and quantify loss, and a defective one can occasionally be rescued by other evidence in the file. The condition that changes the picture most often is timing – a regime built before access was granted behaves very differently from one assembled after a suspicion appears.
There is a reason foreign counsel often assume the document is enough. The three-part test used internationally – information that is secret because it is not generally known, that has commercial value because of that secrecy, and that is subject to “reasonable steps” to keep it secret – is essentially the same logic that WIPO applies to trade secrets, and the same baseline appears in the WTO TRIPS standard for undisclosed information. The instinct is not wrong. It is simply not sufficient in Belarus, where the “reasonable steps” element has been turned into a defined set of documented measures rather than an open factual question.
Belarusian law protects information of a technical, production, economic or organisational nature that has actual or potential commercial value because it is unknown to third parties, is not freely accessible on legal grounds, and has had a commercial secrecy regime introduced over it. Those conditions are cumulative – fail one and the information is not a trade secret, however sensitive it feels.
The statutory framework is the Law of the Republic of Belarus No. 16-З of 5 January 2013 On Trade Secrets, which has been amended more than once. Further amendments reported to take effect in March 2026 mean the exact wording – the definition, the list of required measures and the mandatory content of a counterparty confidentiality agreement – should be confirmed against the official consolidated text before it is relied on in a contract or a claim.
In practice, the regime test comes down to four questions:
This is a documentation task first and a legal task second, and it is the step most companies overlook. The practical elements, namely a commercial secrets policy, a defined scope, access rules, employee undertakings and confidentiality schedules, are the building blocks of a working commercial secrets and non-compete framework. Measuring your own records against that structure tends to reveal the weak spots quickly.
Source code is protectable as a trade secret, but it is a fragile candidate for four recurring reasons:
The statute also lists categories that cannot be protected this way at all – foundation documents and register data, licensing documentation, and payroll and tax records among them. Spending protection effort on that material is wasted effort; the current list should be checked against the consolidated text rather than a summary.
The employee instrument and the counterparty agreement are separate documents under Belarusian law, with different mandatory content, different forums and different failure modes. Using one template for both is one of the most common drafting errors in technology companies operating in the region.
| Element | Employee non-disclosure | Counterparty confidentiality agreement |
| Parties | Employer and employee | Company and contractor, supplier or development partner |
| Mandatory content | Scope of the employee’s duties in relation to protected information, documented access, non-disclosure of the defined scope | A list of protected information or a procedure for determining it, permitted use, and a confidentiality term that survives termination |
| Duration | Runs during employment and for a stated period afterwards | Runs for the contract term and for a stated period after it ends |
| Forum for breach | Civil court, on employment-related grounds | Economic court, commercial grounds, after the mandatory pre-trial claim step |
| Typical failure mode | NDA signed at onboarding with no scope attached and no record of what was disclosed | Template copied from another jurisdiction, subcontractors unbound, no return-or-deletion obligation |
The comparison is about which instrument does which job, so it does not tell you that one is stronger. It does show why a single document cannot cover both relationships: the mandatory content differs, and the dispute lands in a different court with a different procedural gate.
Three drafting errors show up repeatedly in practice, as a matter of what these files look like rather than as a statistical claim:
Non-compete deserves a separate warning. A post-employment restriction on working for competitors is available in the limited setting of High-Tech Park residents, and it carries a mandatory post-employment payment to the employee. It is not a substitute for a confidentiality regime – it restricts where someone may work, not what they may do with information they already hold – and its terms sit in specific regulation rather than in the general labour rules. Verify the current wording before relying on it.
The workflow point where all of this is decided is onboarding. Access should not be granted before the instrument is signed and the scope is attached, and that applies equally to a new hire, a contractor and a subcontractor. In software development relationships, confidentiality sits inside the broader contract set – development agreement, assignment of rights, licence terms, scope of work – and needs to be drafted as part of the software development and licensing contract package rather than added as a schedule at the end.
Leaks concentrate at workflow transitions rather than at perimeter breaches, which is why a well-drafted NDA so often sits beside an incident nobody controlled.
| Workflow stage | Typical failure | Team that owns it | Control that creates evidence |
| Pre-contract technical disclosure | Architecture and sample code shared to win the deal, before any confidentiality terms exist | Commercial and management | Signed instrument before disclosure, plus a log of what was disclosed and when |
| Subcontractor chain | The contractor delegates development; the client never learns who holds access | Procurement and legal operations | Named-subcontractor approval, flow-down confidentiality obligations, a register of authorised persons |
| Repository and CI access | Broad access granted for convenience during a sprint and never narrowed | Engineering and IT | Role-based permissions, approval record per grant, periodic access review |
| Contractor offboarding | Contract ends, credentials stay live for weeks | HR and IT | Offboarding checklist tied to account revocation, verified and timestamped |
| Support and staging environments | Production-like data and builds sit in environments with laxer controls | IT and engineering | Environment classification, same access rules as production for code and datasets |
| Migration to a new vendor | Code transferred to a new team while the old team retains a copy | Procurement and engineering | Transfer record, deletion certification, exit obligations in the outgoing contract |
What this table shows is ownership: every failure has a team attached, and most have no single owner across the chain. What it does not show is that any one control prevents leaks. Controls reduce the number of people who can leak, shorten the window, and – the part that matters later – produce the record that turns an allegation into a file.
“We trust our people” is a statement of confidence, not control. Trust is a judgment about individuals. A regime, on the other hand, is a documented decision about access, and the two tend to fail in very different ways. Insider risk frameworks recognize this by treating insiders as people who have authorized access and by managing the resulting risk through definition, detection, assessment and response. This is the model set out in CISA’s insider threat mitigation guidance, and it also explains why onboarding, offboarding and contractor transitions offer the highest value for control efforts.
Any expectations a company has of its suppliers should be captured in the contract instead of being taken for granted. Where a counterparty is obliged to apply access controls, maintain access logs and report incidents, the agreement should say so explicitly, and the company’s own supplier management process should mirror those terms. ISO/IEC 27001:2022 on information security management requirements reflects this position by classifying supplier relationships as a control area rather than a matter of procurement. In the long run, maintaining a control is more important than designing it. A measure that was documented at one point and then stopped functioning will produce no evidence when the company actually depends on it.
Before a new development partner or subcontractor receives repository access, the counterparty itself should be checked, not only its contract. Pre-signature checks on a Belarusian counterparty cover registration, management, litigation history and the practical question of who will actually hold the credentials.
The first hours after a suspected leak decide more of the case than the choice of forum does, because evidence that is not preserved on day one is usually not recoverable on day thirty.
| Step | Record to preserve | Owner |
| 1 | Repository access logs, permission history and commit history for the affected repositories | Engineering lead with IT |
| 2 | CI/CD logs, build artefacts and deployment records | DevOps |
| 3 | Device, account and VPN records, including revocation timestamps | IT and security |
| 4 | HR file: employment contract, NDA, scope attachments, access approvals, exit checklist | HR with legal |
| 5 | The protected scope document and proof that the material was marked as protected | Legal operations |
| 6 | Communications with the individual or counterparty, retained in original form | Management, routed to legal |
| 7 | Written statements from the custodians of each record, identifying what it shows | Legal |
Access control and audit-and-accountability records are the standard source of this evidence in any serious investigation; the control families set out in NIST SP 800-53 Revision 5 on security and privacy controls map closely onto the list above, which is why technical teams can usually produce steps 1 to 3 quickly – and why steps 4 and 5 are where files collapse.
Records that are commonly missing when the question first arises:
Two process points decide how usable the file becomes. First, keep technical fact-gathering separate from legal strategy: what is collected, what is disclosed and what stays protected by advice are decisions to be made deliberately, and preservation should not wait for them. Second, be honest about gaps early. A missing access log or an unsigned scope attachment is better disclosed and argued around at the outset than discovered by the other side.
The same review is cheaper as a preventive exercise than as a dispute one. Asking whether the existing regime would survive scrutiny – before anyone has left – is the substance of a pre-dispute legal audit of the confidentiality set-up, and it tends to surface the same five or six gaps every time.
Route selection should be run on enforceability and control over evidence and confidentiality, not on speed or fee alone. Those are fairer criteria because the reader’s real exposure is not the price of a claim but whether recoverable loss can be proven and whether the dispute becomes public.
| Route | When it fits | Confidentiality | Evidence burden | What it can deliver | Main constraint |
| Civil court (employment-related) | Claim against a current or former employee | Public hearings as a rule | Regime documents, access records, proof of loss | Damages, injunctive relief where available | Procedural limits and the difficulty of quantifying loss |
| Economic court (commercial) | Claim against a contractor, supplier or partner | Public hearings as a rule | Contract, defined scope, access and disclosure evidence | Damages, penalties, obligations to cease | Mandatory pre-trial claim step before filing |
| Arbitration | Cross-border relationships with a valid clause | Usually confidential by default | Same documentary base, different procedure | Award enforceable under the applicable convention | The clause must already exist and be valid |
| Mediation | Relationship worth preserving; unclear evidence | Confidential by design | Negotiation-driven, no strict proof standard | Settlement, deletion undertakings, continued supply | Not enforceable as a finding; depends on counterparty willingness |
| Criminal complaint | Unlawful access to systems or disclosure in defined circumstances | Investigation confidentiality, limited party control | Criminal standard, state-driven fact-finding | Punitive outcome, investigative pressure | Not a recovery mechanism; specific elements and practice must be verified |
Read the table as a set of trade-offs, not a ranking. It does not show that arbitration is better than court, or that a criminal complaint accelerates a civil claim – it shows what each route can produce and what each one costs in control. The conditions that most often change the answer are the counterparty’s location, whether assets sit outside Belarus, whether the counterparty is an HTP resident, and whether the signed contract contains a workable dispute clause at all.
A short sequence works better than a general preference:
For a commercial leak involving a Belarusian counterparty, the economic court route begins with a mandatory pre-trial claim, and the sequence from there – claim, mediation, arbitration where agreed, court – is the same path described in the pre-trial and economic court route for technology disputes.
One constraint was fixed long before the leak. An arbitration or forum clause in a contract with a Belarusian company determines where the dispute is heard, in what language, and how much of it becomes public – and a defective clause can foreclose the route the company would now prefer. That decision belongs in drafting, not in enforcement.
It is not. An NDA is only one element of the broader protection regime, and it becomes effective only when certain conditions are met. The information it covers must be clearly defined and marked, access to that information must be documented, and the required protective measures must have been in place at the time of the leak. If any of these elements is missing, the company ends up claiming a breach of a loosely worded obligation instead of proving that a protected asset was misappropriated. A strong case file should therefore contain more than the agreement itself. It also needs the scope attachment, the access records and the internal policy that was in effect on the relevant date.
Only in the narrow setting where the employer is a High-Tech Park resident, and the restriction comes with a mandatory post-employment payment to the employee. It also does not do the work of a confidentiality regime: it limits where a person may work, not what they may do with information already in their hands. The wording sits in specific regulation and should be checked against the current text before it goes into a contract.
At minimum a list of the protected information or a documented procedure for determining it, a statement of the purposes for which the contractor may use it, and a confidentiality term that continues after the contract ends. In practice, add the return-or-deletion obligation, the requirement to bind the contractor’s own developers and subcontractors, and a notification duty on suspected leaks – these four additions are where most templates are silent.
Claims connected to an employment relationship go to civil court, while claims against a commercial counterparty go to the economic court after the mandatory pre-trial claim step. Where a valid arbitration clause exists, that replaces the court route for the covered disputes. The forum was determined by the documents signed at the start, so the realistic question after a leak is which route the existing clause allows.
A company may claim both direct losses and lost profits, and it can also seek a contractual penalty if the agreement includes one. The real difficulty lies elsewhere. Causation and the amount of damage are usually the most vulnerable parts of a claim. To succeed, the company must show a clear link between the other party’s conduct and a loss that can be measured, relying on its own commercial, financial and technical records. A penalty clause is considerably simpler to enforce than a calculation of lost profits. This is precisely why it should be written into the contract well before any dispute arises.
Yes, criminal proceedings are possible in certain situations, and they may run at the same time as a civil case. Belarusian law provides criminal remedies for unlawful access to computer information and, under specific conditions, for the disclosure of commercial secrets. However, these proceedings follow their own rules. The standard of proof is different, the state controls the process, and the company has no say over how quickly the case moves forward. Because the required elements and current enforcement practice turn on the particular facts, they should be checked against the applicable code and recent practice instead of being inferred from a general overview.
An NDA, on its own, offers far less protection than most businesses assume. The safeguard that matters is the confidentiality regime, and the agreement merely decides who answers for a breach of that regime. Companies that hold their documentation up against the requirements of an actual leak dispute frequently find obligations that no one is able to test. Usually, this happens for one of three reasons: the scope of protected information was never put into writing, access was never documented, or the required measures were formally approved but never implemented.
In Belarus, effective protection of trade secrets depends first on a written scope and a recorded access regime. Signing the agreement is only one step in that process. The most economical point to address these issues is the onboarding and contract execution stage, well before a dispute appears. Three reviews are worth scheduling this quarter. The first concerns scope: is it documented and attached to every instrument that relies on it? The second concerns access: can each person and company with access to the repository be connected to an approval and a signed undertaking? The third concerns durability: would the confidentiality term and the forum clause in your template still hold once the contract has come to an end? A few hours are enough for each review. Closing the same gaps during an ongoing dispute is likely to take months.
